[libfuzzer] content/renderer fuzzer.

content/test/renderer_fuzzer.cc

Index: content/test/renderer_fuzzer.cc
diff --git a/content/test/renderer_fuzzer.cc b/content/test/renderer_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..9bc269066531c2ed5f644847c77df80f7b0d842f
--- /dev/null
+++ b/content/test/renderer_fuzzer.cc
@@ -0,0 +1,65 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Fuzzer for content/renderer
+
+#include <stddef.h>
+#include <stdint.h>
+#include <memory>
+
+#include "base/feature_list.h"
+#include "content/common/navigation_params.h"
+#include "content/public/test/render_view_test.h"
+#include "content/renderer/render_view_impl.h"
+#include "content/test/test_render_frame.h"
+#include "gin/v8_initializer.h"
+#include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
+
+using namespace content;

[sky, 2016/06/02 21:57:13]

Why not put this in the content namespace?

[aizatsky, 2016/06/02 22:07:05]

Done.

[aizatsky, 2016/06/02 22:07:05]

Done.

+
+class FuzzerRenderTest : public RenderViewTest {
+ public:
+  void TestBody() override {}
+
+  void SetUp() override { RenderViewTest::SetUp(); }
+
+  RenderViewImpl* view() { return static_cast<RenderViewImpl*>(view_); }

[sky, 2016/06/02 21:57:13]

Can you use the public types?

[aizatsky, 2016/06/02 22:07:05]

Done.

+
+  TestRenderFrame* frame() {
+    return static_cast<TestRenderFrame*>(view()->GetMainRenderFrame());
+  }
+};

[sky, 2016/06/02 21:57:13]

private: DISALLOW.. (here and below).

[aizatsky, 2016/06/02 22:07:05]

Done.

+
+struct Env {
+  Env() {
+    base::CommandLine::Init(0, nullptr);
+    base::FeatureList::InitializeInstance(std::string(), std::string());
+
+    blink::WebRuntimeFeatures::enableExperimentalFeatures(true);
+    blink::WebRuntimeFeatures::enableTestOnlyFeatures(true);
+    gin::V8Initializer::LoadV8Snapshot();
+    gin::V8Initializer::LoadV8Natives();
+
+    test_.reset(new FuzzerRenderTest());
+    test_->SetUp();
+  }
+
+  TestRenderFrame* frame() { return test_->frame(); }
+
+  std::unique_ptr<FuzzerRenderTest> test_;

[sky, 2016/06/02 21:57:13]

structs don't use '_' in the name.

[aizatsky, 2016/06/02 22:07:05]

Done

+};
+
+static Env* env = new Env();

[sky, 2016/06/02 21:57:13]

Is there no setup/tear down type equivalent?

[aizatsky, 2016/06/02 22:07:05]

No. Fuzzers do not do teardowns. There's only implicit setup at module
initialization time. We run them to crash.

+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  std::string input(reinterpret_cast<const char*>(data), size);
+
+  CommonNavigationParams common_params;
+  common_params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
+  common_params.url = GURL("data:text/html," + input);
+  env->frame()->Navigate(common_params, StartNavigationParams(),
+                         RequestNavigationParams());
+
+  return 0;
+}